chore(security): add scheduled audit workflow

Author: MustBeSimo

.github/workflows/security-audit.yml

@@ -0,0 +1,82 @@
+name: Security Audit
+
+on:
+  schedule:
+    # 09:00 UTC every 3 days
+    - cron: '0 9 */3 * *'
+  workflow_dispatch:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+  security-events: write
+  issues: write
+
+jobs:
+  gitleaks:
+    name: Gitleaks (secret history)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  trufflehog:
+    name: TruffleHog (verified secrets)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: TruffleHog scan
+        run: |
+          docker run --rm -v "$GITHUB_WORKSPACE:/tmp" -w /tmp \
+            ghcr.io/trufflesecurity/trufflehog:latest \
+            git file:///tmp/ \
+            --only-verified \
+            --fail \
+            --no-update \
+            --github-actions
+
+  semgrep:
+    name: Semgrep (SAST)
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - run: semgrep ci --config=p/secrets --config=p/owasp-top-ten --config=p/javascript --config=p/typescript --config=p/python
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+
+  notify:
+    name: Open issue on failure
+    needs: [gitleaks, trufflehog, semgrep]
+    if: failure()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          script: |
+            const title = `Security audit failed: ${new Date().toISOString().split('T')[0]}`;
+            const body = [
+              `Scheduled security audit failed on \`${context.sha.slice(0,7)}\`.`,
+              ``,
+              `**Run:** ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+              ``,
+              `Triage:`,
+              `1. Open the run, identify which job failed (gitleaks / trufflehog / semgrep).`,
+              `2. Real finding: rotate credential, purge from history, close issue with note.`,
+              `3. False positive: add to \`.gitleaksignore\` or \`.semgrepignore\` with justification.`,
+            ].join('\n');
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title,
+              body,
+              labels: ['security', 'automated']
+            });